Authentication of users to avoid illicit access to network resources by unauthorized users is of paramount importance in providing and maintaining ecommerce and other network services. For example, network users must be able to trust that network providers can maintain confidential data securely, and network providers must be able to trust that unauthorized network users are not seeking to exploit provided resources.
Unfortunately, authentication techniques are often difficult, expensive, or otherwise problematic for both users and providers. For example, providers typically wish to minimize the liability and expense of maintaining and using authentication data for large numbers of users. Meanwhile, users typically wish to avoid the inconvenience and difficulty of remembering and using the various types of passwords, question/answer pairs, PINs, and other authentication techniques that are commonly used. Moreover, such authentication techniques are often subject to breaches, such as when an illicit user obtains a user's password.
One technique for providing authentication is known as multi-factor authentication, or MFA. Generally speaking, MFA uses two or more of something that the user knows (e.g., username/password), something the user possesses (e.g., a mobile device), and a characteristic of the user (e.g., biometrics, such as fingerprints). By authenticating using multiple ones of these factors, MFA helps to ensure a security and reliability of authentication processes.
In one example of MFA, a first authentication technique (such as a username/password combination) is used as a first authentication factor for network access, and then a PIN is separately provided to the user, often as a text message to the user's mobile device, as a second authentication factor. By entering the PIN separately upon receipt, the user obtains the desired network access. In these techniques, the odds of secure authentication being successful are increased by the additional use of an out-of-band or secondary communications channel (e.g., the text message) to the user's mobile device, which may be presumed to be in the unique possession of the user. However, users often find the requirements of obtaining and separately entering the PIN to be inconvenient, and subject to potential user error in quickly and correctly entering the provided PIN.